Downloading an innocent update for Microsoft Office at work can bring on a world of hurt to yourself and your place of business. As malware download attacks continue to grow, Cobalt Gang is in the news again for its highly successful malware downloader called CobInt. It’s no coincidence the name closely mirrors Cobalt, as the hackers want the credit given to the Cobalt gang. Many of CobInt’s victims are easily lured by fake Microsoft updates that are loaded with malware.

The group originally made the news in 2013, after a successful string of attacks on over 100 financial institutions in 40 countries. Despite efforts by international forces leading to the arrest of Cobalt’s mastermind earlier this year, they’re at it again with the new and improved CobInt downloader.

Fake update downloads are on the rise, and Microsoft isn’t the only attack vector used by hackers. Google Chrome, Adobe Flash, and Firefox users have also been duped into installing bogus updates. Malicious downloads have more than just one goal in mind. In this case, when CobInt gains access to a system through a fake update, all bets are off since the initial malware download is just the beginning. Once the malware is downloaded as the first stage, the virus spends time “looking around” systems and hackers decide if it’s worth it to continue with additional attack stages. This dwell-time allows hackers to observe the inner workings of a system and its weaknesses, finding even more ways to do damage. Based on what the original malware download exposes, additional malware can be sent to infiltrate systems and find different attack vectors. It’s an effective way for malware download leaders like CobInt to maximize damage in a much more invasive and successful attack.

Since download malware is on the rise, users need to find a way to not only detect it, but avoid being a victim. Always start with a healthy dose of suspicion before allowing downloads. Assume emails or pop-up messages notifying you of an update for anything are fake from the start. Never click on those big and tempting “Download” buttons before doing your homework. In fact, not opening emails about updates and simply deleting them (it’s your option to report them as spam to your email service provider before deleting) is your best bet.

Going directly to a website--never click on an email download link or call a phone number provided, as they are also fake--to find if an update is available is a great way to find if the download is legitimate. Always use update services that apps and programs make available. You can choose settings allowing updates to install automatically or choose settings that give you update details before allowing the download. If there’s any question about downloading an update, don’t do it. It’s always worth it to do a little homework and find out if that update is the real deal.

We often warn about malvertising, or malicious advertisements, here and how they are being used in the world of cybercrime. It’s often recommended that ad blocking software and apps be installed on all internet-connected devices. The cybercriminals have apparently got wind of that advice and have installed several malicious ad-blocking apps into the Google Chrome Store.

Some 20 million downloads of infected products have occurred. They include:

Adblock Pro

AdRemover for Google

HD for YouTube

uBlock Plus

Webutation

If you have downloaded any of these products, delete them completely. Researchers at AdGuard have determined that ironically, some of them can actually leak information about your visit to some websites. Others can be used to hijack the user’s Chrome browser to do whatever hackers want it to do. That may mean including your browser in a botnet. These are used in the world of cybercrime to perform malicious activities, such as denial-of-service attacks.

While Chrome and the official store for getting extensions is targeted for distribution in this one, it is still much safer to download your software and apps from the official stores for the respective devices. Obviously, some bad products get through, but everything that gets into those stores does go through more security testing before they are allowed to stay.

Google has since removed all of these products, but it is most certainly not the last time things such as this may appear. And the advice to install ad-blocking products continues to be true. Just do your research beforehand. Read reviews and product descriptions of anything you install and if there is any doubt about it at all, pick something else.

Several popular websites are being targeted with malware-laced updates. SquareSpace and Joomla are just two of the sites involved in a massive “FakeUpdates” campaign injecting malware disguised as security and software updates. Thousands of websites have recently become victims of the attacks and experts believe they go back to at least December of 2017.

Website content management systems (CMS) are currently in the crosshairs. The CMS involved here revolves around the creation and management of digital content. It’s usually in a collaborative environment with many users. That makes popular websites like WordPress prime targets for FakeUpdates. According to an Ars Technica report, visitors to these websites receive fake update notifications and the malware authors go to great lengths to remain undetected. They give only one update notice per IP address and even have digital certificates that look legitimate. The websites involved display authentic looking update messages to visitors. They instruct users to install updates for Chrome, Flash, and Firefox browsers. When they do, banking malware and trojans, among other viruses, get installed on their devices.

Compromised websites are nothing new, but the FakeUpdates campaign is. Experts believe that although a very sophisticated attack is involved along with being well, human, it’s ultimately bad security practices allowing it to happen in the first place. Poorly protected websites allowing CMS to be compromised are at the base of the problem. System administrators fail to patch systems with proper protections, including for updates, plugins, and add-ons their website uses.

Scores of unwitting users are now victims, but there are ways to avoid becoming one of them. Experts suggest avoiding updates for anything from a pop-up window, especially those involving device security patches. Take the time to go to the official website for the update and download only from there. The success of the FakeUpdates campaign is a clear signal that navigating safely in cyberspace is becoming more difficult every day. The expectations of users and website security system administrators together, done right, makes a safer cyberworld for us all.

It’s a message we all dread and hope will never happen: “You’ve been hacked.” That gnawing pit in your stomach, a combination of helplessness and horror – but all’s not lost. There’s an instant offer to make that awful thing go away, so you jump at it. After all, who wouldn’t? Tech support scams have been around since, well, the Internet. Like phishing and other hacking attempts, they improve over time. Although it may be difficult to prove that consumer awareness improves with time in the fight against hackers, hackers themselves clearly learn from history and use it to sharpen their skills. Whether it’s a screen pop-up or a phone call, tech support scams, like many fraudulent schemes – prey on your emotions.

In the latest con, tech support scammers were found using call optimization services to bolster their success rates. Surreptitiously gaining even more information about unsuspecting consumers and using it against them doesn’t sound fair, and it’s not – but it works. One way or another, users are redirected to the scammer's web page offering a “toll-free” number to call for assistance. By using call optimization, those toll free numbers can change depending on the location of the caller to appear as local, when in reality they could be calling a scammer anywhere in the world. Other services offered are tracking and providing details about callers. As we know, hackers use any grain of information they can collect on you to worm their way into your world. Countless organizations use call optimization to improve their business, and hackers are no different.

The Federal Trade Commission (FTC) website gives great insight into tech support scams and the many scenarios they use to pull you in. From calls offering refunds for unused tech support services to asking for access to your device to “fix” the problem, to getting you to install malware disguised as tech support software – the list goes on. Below are tips from the FTC should you get a call or pop-up from alleged “tech support.”

If you get any type of call from someone claiming to be tech support, hang up immediately – they’re not who they say they are. Even if the phone number looks legitimate, it’s not. Scammers have ways to appear authentic, and so will whatever they tell you, if you engage in conversation with them. These people make a living out of conning people with sincere concerns – don’t be their next victim.

Pop-up messages needing you to call about your device security or otherwise are always scams. There are legitimate messages from software companies for products you have installed alerting you to updates, but they don't ask you to call, especially regarding a computer problem.

Any concern about your device software, especially about a message, should be dealt with the software company directly. Don’t use the phone number provided. Instead, contact the software company by getting their number from the software packaging or from a legitimate website. Also, let them know scammers are using their name to deceive customers.

You’ve heard it before. There’s an issue with Adobe Flash. Yet another vulnerability and it needs to be patched. Before we get into this recent issue, just understand that very little of what you do on the Internet these days needs to use Adobe Flash. It has been replaced by other products for the most part. However, in this most recent case, a legitimate Adobe Flash update is being used to illegitimately mine the digital currency Monero. Your system does all the heavy lifting and the hackers get the reward in the form of Monero.

This particular bot is called XMRig. It comes courtesy of an Adobe Flash update that is hidden in spoofed URLs. Researchers at Palo Alto Networks found 113 of these.

Before going any further, disable Adobe Flash in all of your browsers. Adobe Flash is dangerous because it can directly access your computer memory. That’s just asking for trouble. Google Chrome and Mozilla no longer even support it. So go into your settings and disable it, no matter what browser you use. Once you find out that you really don’t need it, get rid of it completely. In fact, even Adobe is putting an end to Flash in 2020. It’ll still be around of course. It just will not be supported. So all of the vulnerabilities that come out involving it, will never get patched. That can open up a world of hurt for anyone still using it.

You don’t need it on your mobile devices either. There have been fake Adobe Flash updates found in the legitimate stores in the past. They have been removed, but it’s not unlikely that you will see others or see these fake ones in other places. If you see a notification pop up that you need to update your Adobe Flash, don’t click it.

When it comes to mining cryptocurrency, this nets the miner free money; in the form of the digital currency it’s mining. Mining is how the unregulated cryptocurrencies reconcile all the transactions. It’s as if everyone who has the currency is simultaneously balancing their spreadsheets. It takes a lot of computing power. That’s why these miners want to use other peoples’ systems. They use your machine, your electricity, and batteries and they get the Dinero!

The researchers are not quite sure how users find these URLs. Suffice it to say that if you need to update any product, go directly to the developer’s website to do it. Don’t follow a link on a popup window. Those are often phishing or direct you to some type of malware. Every once in a while, reboot your computers and mobile devices. This allows the operating system to “phone home” and find out if legitimate updates are available for what is running on your system.

XMRig has been making its rounds since August, according to the researchers. It’s believed that more than $25,000 in Monero has been mined using illegitimate browser-based scripts each month.

Earlier this year, the Spanish National Police arrested the alleged head of notorious Carbanak cybercrime group. Experts warn the confinement of the Carbanak kingpin will not stop the proliferation of the group’s highly successful spear-phishing campaigns. The malware strains are still out there, becoming more refined and more powerful with time. Over 40 countries and their financial systems have been attacked by the Carbanak group. The kingpin’s arrest was largely due to cooperation among law enforcement around the world.

Since 2015, the Carbanak syndicate gained notoriety as a highly effective cybercrime ring targeting financial and banking institutions and e-payment systems worldwide. Their haul is believed to have hit the $1 billion mark as of this year. Perhaps Carbanak’s most aggressive malware, Cobalt, allowed its members to steal 10 million Euros per heist. Last year, it was discovered the group switched targets from the financial arena to retail, restaurants, and hospitality services.

Since its inception in 2013, Carbanak grew to refine its malware-laced spear phishing hacks. The group would send these malicious attachments in emails to bank employees. Once the employees acted on the attachment, Carbanak was in motion. Their malware infects the network, allowing them to control ATM’s and e-payment networks. A group member would be at a pre-determined ATM at a specific time and receive a payout anyone would envy. They also hacked financial e-payment systems, easily transferring funds to their own criminal accounts. Carbanak also helped themselves to bank accounts and other financial data like credit and debit card numbers. In fact, their model is so successful that other cybercriminals are using it for their own hack attacks. In November, a group called Silence was discovered to have very similar traits to Carbanak. Experts know other hackers are using Carbanak and their gang model for their own gain. Other strains of Carbanak’s malware are still out there and getting stronger.

The one given the group and other phishing hacks count on for success is human vulnerability, or gullibility.

Groups like Carbanak count on unsuspecting employees getting tricked by very slick emails. From there, it unleashes a malware virus that could cripple their company data systems, costing their company and customers untold harm.

That’s why security professionals continue to stress the importance of being on the lookout for phishing attacks. Unfortunately, there is no template for these anymore and they are even tricking the most technically adept these days, putting everyone on a level playing field.

So, always review email messages carefully for unexpected attachments or links, or instructions to head to a particular site to perform an action. Instead, log into your accounts directly from pre-saved links, don’t click attachments or links unless you are 100% certain they are safe, and always question strange requests to send wire transfers, provide credentials or sensitive information, or to do something in a rush for fear of something bad occurring. Carbanak, and other hacking groups like them, are banking on us all doing exactly these things.

We use cookies to give you a more relevant browsing experience and improve our website. Using this site means that you agree with our use of cookies policy.

Chances are pretty good that you have heard the term business email compromise or BEC by now. It is a type of wire transfer fraud that the FBI has deemed one of the most prevalent types of scam going around these days. In 2017, there were over 15,690 complaints that resulted in total adjusted losses of more than $675 million. That is an 87% increase over 2016 and it is expected to continue to rise. The Identity Theft Resource Center (ITRC) reported that of the fraud related complaints reported in 2017, the most common type was wire transfer fraud.

Chances are pretty good that you have heard the term business email compromise or BEC by now. It is a type of wire transfer fraud that the FBI has deemed one of the most prevalent types of scam going around these days. In 2017, there were over 15,690 complaints that resulted in total adjusted losses of more than $675 million. That is an 87% increase over 2016 and it is expected to continue to rise. The Identity Theft Resource Center (ITRC) reported that of the fraud related complaints reported in 2017, the most common type was wire transfer fraud.

This Privacy Policy applies to and is provided on behalf of Stickley on Security. (collectively referred to as "We", "Us", or "Our") and describes Our information gathering
practices and policies in connection with this Site. We value your ("User", "You", or "Your") privacy and recognize the sensitivity of Your personal information. We are
committed to protecting Your personal information and using it only as appropriate to provide You with the best possible service, products, and opportunities. Use of this
Site constitutes consent to Our collection and use of personal data as outlined herein.

COLLECTION AND USE OF PERSONAL INFORMATION FROM SITE USERS

We collect personally identifiable information from Users who provide it to us for billing purposes. For example, We collect Your name, street address, city, state, zip
code, telephone number, email address, and financial information, such as a credit card number, if You use the Site to register or renew a license. We may use this
information to contact You regarding the status of Your account and orders placed, and to alert You to new information, products and services, events and other
opportunities. We recognize that You may wish to limit the ways in which You are contacted and provide You with opt-out options below. Information about Our experiences and
transactions with you, such as your payment history, types of services and/or products you purchased are not shared with organizations outside of Stickley on Security.

We will not disclose to third parties (that is, people and companies that are not affiliated with Us) individually identifying information, such as names, postal and e-mail
addresses, telephone numbers, and other personal information, except to the extent that it is necessary to process and provide You with Your order, license request or
other request. Your contact information may also be provided to the extent necessary to comply with applicable laws or legal processes (e.g., subpoenas), or to meet contractual obligations outlined in this policy, or to protect Our
rights or property. We will cooperate with all law enforcement authorities.

If Your order, license request or other request is processed by a third-party, or if You are provided with bulletin boards and chat rooms and/or email capabilities on
this Site, please note that in the event that You voluntarily disclose personally identifiable information in those instances, that information, along with any substantive
information disclosed in Your communication or post, can be collected, correlated and used by third parties. This may result in unsolicited messages from third parties. Such
activities are beyond Our control, and We encourage You to check the applicable privacy policy of such party when providing personally identifiable information.

For each visitor to this Site, Our server can detect and collect certain information, including the User's domain name and e-mail address, and can identify the Web pages the
User visited or accessed. We may use this information in order to measure interest in and use of the various areas of the site.

We do not knowingly solicit information from children and We do not knowingly market the Site or its services to children.

OPT-OUT

You may at any time opt out of having Your personal information used by Us to send You promotional correspondence by contacting Us via e-mail provided in the "Contact Us"
section below.

PROMOTION CODES

"Promotion codes" are offered by third-party affiliates of the Stickley on Security Training Videos. If you choose to include a "Promotion Code" when placing your order, the affiliate who is associated with that promotional code will receive your organizations name. They will NOT however receive any other information related to your account. The sharing of the organization name only applies when a "Promotion Code" is included during the order process.

USE OF COOKIES

1. First-party cookies
User input cookies to keep track of the user's input when filling online forms, shopping carts, etc., for the duration of a session, or persistent cookies limited to the duration of an operation such as purchase or trial;
User identification persistent cookies, to identify the user visited the website for the first time;
Authentication cookies, to identify the user once he has logged in, for the duration of a session;
user interface customization cookies such as time zone and shopping cart status info, for the duration of a session (or slightly longer).

2. Third-party cookies
social plug in content sharing cookies, for logged in members of a social network;
Google Analytics cookies to generate statistical data on how the visitor uses the website.

How do we use them?
Where strictly necessary. These cookies and other technologies are essential in order to enable the Services to provide the feature you have requested, such as remembering you have logged in.

For functionality. These cookies and similar technologies remember choices you make such as time zone and shopping cart info. We use these cookies to provide you with an experience more appropriate with your selections and to make your use of the Services more tailored.

For performance and analytics. These cookies and similar technologies collect information on how users interact with the Services and enable us to improve how the Services operate. For example, we use Google Analytics cookies to help us understand how visitors arrive at and browse our products, services and website to identify areas for improvement such as navigation, user experience, and marketing campaigns.

Social media cookies. These cookies are used when you share information using a social media sharing button or .like. button on our websites or you link your account or engage with our content on or through a social media site. The social network will record that you have done this. This information may be linked to targeting/advertising activities.

How can you opt-out?
To opt-out of our use of cookies, you can instruct your browser, by changing its options, to stop accepting cookies or to prompt you before accepting a cookie from websites you visit. If you do not accept cookies, however, you may not be able to use our Services.

Updates to this Cookie Policy
This Cookie Policy may be updated from time to time. If we make any changes, we will notify you by revising the "effective starting" date at the top of this notice.

INFORMATION SECURITY AND CONFIDENTIALITY

We maintain physical, electronic and procedural safeguards to prevent the unauthorized release of or access to Your personal information. When We transfer and receive
certain types of sensitive information such as financial information, We redirect visitors to a secure server. We do not store or reuse Your credit card information. We do
not record or manager financial information about You (including credit card and other payment information). However, such precautions do not guarantee that this Site is
invulnerable to all security breaks. We make no warranty, guarantee, or representation that the use of this Site is protected from viruses, security threats, or other
vulnerabilities and that Your information will always be secure. We cannot guarantee the confidentiality of any communication or material transmitted to/from Us via the Site
or e-mail. Use of the Internet is solely at Your own risk and is subject to all applicable local, state, federal, and international laws and regulations.

THIRD PARTY PROCESSING

Stickley on Security uses the vendor Authorize.net to process all payment transactions. When making a purchase on this site, You also accept the Terms and Conditions and
Privacy Policy of Authorize.net.

CONTACT US

This Privacy Policy may be updated periodically and posted on this Site. It applies only to Our online practices and does not encompass other areas of the organization. We
reserve the right to change this Policy at any time by posting revisions. By accessing or using the Site, You agree to be bound by all of the Terms of this Privacy Policy as
posted at the time of Your access or use. We reserve the right to contact Users of the Site regarding changes to the Terms and Conditions generally, this Privacy Policy
specifically, or any other policies or agreements relevant to the Site's Users. If You have any questions about this Policy, You may email to:

Keep up with the latest cyber security news through our weekly Fraud News & Alerts updates.
Each week you will receive an email containing the latest cyber security news, tips and breach notifications.

Simply complete the form below and you're all set.

You're all set!

You will receive your first official security update email within the next week.
A welcome email has also just been sent to you. If you do not receive this email within the next few minutes, please check your Junk box or spam filter to confirm our emails are not being blocked.